Abstract: A method of authenticating user access to a restricted resource across a computer network, the method characterised by: communicating client device configuration data to a server and assigning a risk analysis score based on the client device configuration data; and generating an alert at a client device in response to the risk analysis score.